Guides · Updated 2026-10-11
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that lets a domain owner say what receivers should do with mail that claims to come from their domain but fails authentication, and where to send reports about it.
A message passes DMARC when it passes SPF or DKIM and the domain that passed is aligned with the domain in the visible From: address. Alignment is what stops an attacker from passing SPF with their own domain while showing yours in the From line.
DMARC lives in a TXT record at _dmarc.yourdomain.com, for example:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
p: policy: none (monitor only), quarantine (treat as suspicious, usually spam folder), or reject (refuse).rua: where aggregate reports go (daily XML summaries from receivers).sp: policy for subdomains (defaults to p).pct: percentage of failing mail the policy applies to (default 100).adkim / aspf: relaxed (r, default) or strict (s) alignment.Start at p=none with reporting, identify every service that legitimately sends as you, fix their SPF/DKIM, then move to quarantine and reject. See how to move from p=none to p=reject. Only quarantine and reject actually stop spoofing.
This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.